CVE-2025-10005 describes an insecure direct object reference vulnerability in the PPWP – Password Protect Pages WordPress plugin. The vulnerability arises from insufficient validation of a user-controlled key in the ppw_free_set_password AJAX action, allowing authenticated users with Contributor or higher privileges to change the password on any protected post. This bypasses intended access controls and permits unauthorized viewing of protected content. The vulnerability affects all versions up to and including 1.9.20. No official patch or remediation guidance is currently provided by the vendor.

An attacker with Contributor-level or higher access can bypass authorization controls to change passwords on protected posts, thereby gaining unauthorized access to restricted content. The confidentiality of password-protected posts is compromised. There is no indication of impact on integrity or availability. The CVSS score is 4.3 (medium severity), reflecting the limited scope of privilege required and the confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level access to trusted users only. Monitor for updates from the vendor regarding patches or official mitigations.